Skip to main content

2017 | OriginalPaper | Buchkapitel

A Verification Framework for Stateful Security Protocols

verfasst von : Li Li, Naipeng Dong, Jun Pang, Jun Sun, Guangdong Bai, Yang Liu, Jin Song Dong

Erschienen in: Formal Methods and Software Engineering

Verlag: Springer International Publishing

Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.

search-config
loading …

Abstract

A long-standing research problem is how to efficiently verify security protocols with tamper-resistant global states, especially when the global states evolve unboundedly. We propose a protocol specification framework, which facilitates explicit modeling of states and state transformations. On the basis of that, we develop an algorithm for verifying security properties of protocols with unbounded state-evolving, by tracking state transformation and checking the validity of the state-evolving traces. We prove the correctness of the verification algorithm, implement both of the specification framework and the algorithm, and evaluate our implementation using a number of stateful security protocols. The experimental results show that our approach is both feasible and practically efficient. Particularly, we have found a security flaw on the digital envelope protocol, which cannot be detected with existing security protocol verifiers.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

Literatur
1.
Zurück zum Zitat Blanchet, B.: An efficient cryptographic protocol verifier based on Prolog rules. In: Proceedings 14th IEEE Computer Security Foundations Workshop (CSFW), pp. 82–96. IEEE CS (2001) Blanchet, B.: An efficient cryptographic protocol verifier based on Prolog rules. In: Proceedings 14th IEEE Computer Security Foundations Workshop (CSFW), pp. 82–96. IEEE CS (2001)
2.
Zurück zum Zitat Viganò, L.: Automated security protocol analysis with the avispa tool. Electron. Notes Theoret. Comput. Sci. (ENTCS) 155, 61–86 (2006)CrossRef Viganò, L.: Automated security protocol analysis with the avispa tool. Electron. Notes Theoret. Comput. Sci. (ENTCS) 155, 61–86 (2006)CrossRef
3.
Zurück zum Zitat Escobar, S., Meadows, C., Meseguer, J.: Maude-NPA: cryptographic protocol analysis modulo equational properties. In: Aldini, A., Barthe, G., Gorrieri, R. (eds.) FOSAD 2007-2009. LNCS, vol. 5705, pp. 1–50. Springer, Heidelberg (2009). doi:10.1007/978-3-642-03829-7_1 CrossRef Escobar, S., Meadows, C., Meseguer, J.: Maude-NPA: cryptographic protocol analysis modulo equational properties. In: Aldini, A., Barthe, G., Gorrieri, R. (eds.) FOSAD 2007-2009. LNCS, vol. 5705, pp. 1–50. Springer, Heidelberg (2009). doi:10.​1007/​978-3-642-03829-7_​1 CrossRef
4.
Zurück zum Zitat Kremer, S., Künnemann, R.: Automated analysis of security protocols with global state. In: Proceedings 24th IEEE Symposium on Security and Privacy (S & P), pp. 163–178 (2014) Kremer, S., Künnemann, R.: Automated analysis of security protocols with global state. In: Proceedings 24th IEEE Symposium on Security and Privacy (S & P), pp. 163–178 (2014)
5.
Zurück zum Zitat Herzog, J.: Applying protocol analysis to security device interfaces. IEEE Secur. Priv. 4, 84–87 (2006)CrossRef Herzog, J.: Applying protocol analysis to security device interfaces. IEEE Secur. Priv. 4, 84–87 (2006)CrossRef
6.
Zurück zum Zitat Arapinis, M., Ritter, E., Ryan, M.D.: StatVerif: verification of stateful processes. In: Proceedings 24th IEEE Computer Security Foundations Symposium (CSF), pp. 33–47. IEEE CS (2011) Arapinis, M., Ritter, E., Ryan, M.D.: StatVerif: verification of stateful processes. In: Proceedings 24th IEEE Computer Security Foundations Symposium (CSF), pp. 33–47. IEEE CS (2011)
7.
Zurück zum Zitat Delaune, S., Kremer, S., Ryan, M.D., Steel, G.: Formal analysis of protocols based on TPM state registers. In: Proceedings 24th IEEE Computer Security Foundations Symposium (CSF), pp. 66–80. IEEE CS (2011) Delaune, S., Kremer, S., Ryan, M.D., Steel, G.: Formal analysis of protocols based on TPM state registers. In: Proceedings 24th IEEE Computer Security Foundations Symposium (CSF), pp. 66–80. IEEE CS (2011)
8.
Zurück zum Zitat Dong, N., Jonker, H., Pang, J.: Challenges in eHealth: from enabling to enforcing privacy. In: Liu, Z., Wassyng, A. (eds.) FHIES 2011. LNCS, vol. 7151, pp. 195–206. Springer, Heidelberg (2012). doi:10.1007/978-3-642-32355-3_12 CrossRef Dong, N., Jonker, H., Pang, J.: Challenges in eHealth: from enabling to enforcing privacy. In: Liu, Z., Wassyng, A. (eds.) FHIES 2011. LNCS, vol. 7151, pp. 195–206. Springer, Heidelberg (2012). doi:10.​1007/​978-3-642-32355-3_​12 CrossRef
9.
Zurück zum Zitat Dong, N., Jonker, H., Pang, J.: Formal analysis of privacy in an ehealth protocol. In: Foresti, S., Yung, M., Martinelli, F. (eds.) ESORICS 2012. LNCS, vol. 7459, pp. 325–342. Springer, Heidelberg (2012). doi:10.1007/978-3-642-33167-1_19 CrossRef Dong, N., Jonker, H., Pang, J.: Formal analysis of privacy in an ehealth protocol. In: Foresti, S., Yung, M., Martinelli, F. (eds.) ESORICS 2012. LNCS, vol. 7459, pp. 325–342. Springer, Heidelberg (2012). doi:10.​1007/​978-3-642-33167-1_​19 CrossRef
10.
Zurück zum Zitat Dong, N., Jonker, H.L., Pang, J.: Formal modelling and analysis of receipt-free auction protocols in applied PI. Comput. Secur. 65, 405–432 (2017)CrossRef Dong, N., Jonker, H.L., Pang, J.: Formal modelling and analysis of receipt-free auction protocols in applied PI. Comput. Secur. 65, 405–432 (2017)CrossRef
11.
Zurück zum Zitat Meier, S., Schmidt, B., Cremers, C., Basin, D.: The TAMARIN prover for the symbolic analysis of security protocols. In: Sharygina, N., Veith, H. (eds.) CAV 2013. LNCS, vol. 8044, pp. 696–701. Springer, Heidelberg (2013). doi:10.1007/978-3-642-39799-8_48 CrossRef Meier, S., Schmidt, B., Cremers, C., Basin, D.: The TAMARIN prover for the symbolic analysis of security protocols. In: Sharygina, N., Veith, H. (eds.) CAV 2013. LNCS, vol. 8044, pp. 696–701. Springer, Heidelberg (2013). doi:10.​1007/​978-3-642-39799-8_​48 CrossRef
13.
15.
Zurück zum Zitat Needham, R.M., Schroeder, M.D.: Using encryption for authentication in large networks of computers. Commun. ACM 21, 993–999 (1978)CrossRefMATH Needham, R.M., Schroeder, M.D.: Using encryption for authentication in large networks of computers. Commun. ACM 21, 993–999 (1978)CrossRefMATH
16.
Zurück zum Zitat Lowe, G.: An attack on the needham-schroeder public-key authentication protocol. Inf. Process. Lett. 56, 131–133 (1995)CrossRefMATH Lowe, G.: An attack on the needham-schroeder public-key authentication protocol. Inf. Process. Lett. 56, 131–133 (1995)CrossRefMATH
19.
Zurück zum Zitat Rusinowitch, M., Turuani, M.: Protocol insecurity with a finite number of sessions, composed keys is np-complete. Theoret. Comput. Sci. 299, 451–475 (2003)MathSciNetCrossRefMATH Rusinowitch, M., Turuani, M.: Protocol insecurity with a finite number of sessions, composed keys is np-complete. Theoret. Comput. Sci. 299, 451–475 (2003)MathSciNetCrossRefMATH
20.
Zurück zum Zitat Durgin, N.A., Lincoln, P., Mitchell, J.C.: Multiset rewriting and the complexity of bounded security protocols. J. Comput. Secur. 12, 247–311 (2004)CrossRef Durgin, N.A., Lincoln, P., Mitchell, J.C.: Multiset rewriting and the complexity of bounded security protocols. J. Comput. Secur. 12, 247–311 (2004)CrossRef
21.
Zurück zum Zitat Meier, S.: Advancing automated security protocol verification. Ph.D. thesis, ETH (2013) Meier, S.: Advancing automated security protocol verification. Ph.D. thesis, ETH (2013)
22.
Zurück zum Zitat Mödersheim, S.: Abstraction by set-membership: verifying security protocols and web services with databases. In: Proceedings 17th ACM Conference on Computer and Communications Security (CCS), pp. 351–360. ACM (2010) Mödersheim, S.: Abstraction by set-membership: verifying security protocols and web services with databases. In: Proceedings 17th ACM Conference on Computer and Communications Security (CCS), pp. 351–360. ACM (2010)
23.
Zurück zum Zitat Guttman, J.D.: Fair exchange in strand spaces. In: Proceedings 7th International Workshop on Security Issues in Concurrency (SECCO), EPTCS, vol. 7, pp. 46–60 (2009) Guttman, J.D.: Fair exchange in strand spaces. In: Proceedings 7th International Workshop on Security Issues in Concurrency (SECCO), EPTCS, vol. 7, pp. 46–60 (2009)
24.
Metadaten
Titel
A Verification Framework for Stateful Security Protocols
verfasst von
Li Li
Naipeng Dong
Jun Pang
Jun Sun
Guangdong Bai
Yang Liu
Jin Song Dong
Copyright-Jahr
2017
DOI
https://doi.org/10.1007/978-3-319-68690-5_16

Premium Partner